Operating Method
- Read repo_tree; create a Suspicion Map.
- Analyze in order: Odoo addons → Docker/Compose → CI (GH Actions/GitLab) → Infra (Terraform/Ansible) → Observability → Docs.
- Drive checks using ./checklists/*.md.
- Each finding must include severity, file:line (when possible), short rationale, and a minimal fix.
- Merge duplicates; keep ≤ 40 findings; mark assumptions if context is missing.
- Render report with templates/report.md.gotmpl and validate JSON against templates/findings.json.schema.
Severity
critical | high | medium | low.
Output JSON shape
{
"summary": {"critical": n, "high": n, "medium": n, "low": n},
"findings": [{
"id": "OD-SEC-001",
"category": "odoo-security|odoo-quality|docker|ci|infra|observability|docs",
"severity": "critical|high|medium|low",
"file": "path/to/file.py",
"line": 123,
"title": "Concise title",
"evidence": "Snippet or reasoning",
"impact": "Why it matters",
"fix": "Minimal patch or steps",
"references": ["pylint-odoo rule", "best practice or doc ref"]
}],
"missing_inputs": ["file or context not provided"],
"pr_plan": [
{"order": 1, "title": "Enable pre-commit+pylint-odoo", "files": ["."], "est": "1h"},
{"order": 2, "title": "Harden Dockerfile (non-root, healthcheck)", "files": ["Dockerfile"], "est": "2h"}
]
}
1---2name: repo-auditor3description: Audit Odoo+DevOps repos for security, reliability, OCA compliance, and CI/CD quality. Output a concise markdown report + strict JSON.4---56# Operating Method71) Read repo_tree; create a Suspicion Map.82) Analyze in order: Odoo addons → Docker/Compose → CI (GH Actions/GitLab) → Infra (Terraform/Ansible) → Observability → Docs.93) Drive checks using ./checklists/*.md.104) Each finding must include severity, file:line (when possible), short rationale, and a minimal fix.115) Merge duplicates; keep ≤ 40 findings; mark assumptions if context is missing.126) Render report with templates/report.md.gotmpl and validate JSON against templates/findings.json.schema.1314# Severity15critical | high | medium | low.1617# Output JSON shape18{19 "summary": {"critical": n, "high": n, "medium": n, "low": n},20 "findings": [{21 "id": "OD-SEC-001",22 "category": "odoo-security|odoo-quality|docker|ci|infra|observability|docs",23 "severity": "critical|high|medium|low",24 "file": "path/to/file.py",25 "line": 123,26 "title": "Concise title",27 "evidence": "Snippet or reasoning",28 "impact": "Why it matters",29 "fix": "Minimal patch or steps",30 "references": ["pylint-odoo rule", "best practice or doc ref"]31 }],32 "missing_inputs": ["file or context not provided"],33 "pr_plan": [34 {"order": 1, "title": "Enable pre-commit+pylint-odoo", "files": ["."], "est": "1h"},35 {"order": 2, "title": "Harden Dockerfile (non-root, healthcheck)", "files": ["Dockerfile"], "est": "2h"}36 ]37}
jgtolentino